ch.rasc:wampspring (1.0.0) potentially affected by CVE-2026-41838 via org.springframework:spring-websocket (4.0.0.release)

org.springframework:spring-websocket MAVEN version 4.0.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-websocket and may be impacted: - ch.rasc:wampspring 1.0.0 Source cves: CVE-2026-41838 Source advisory:...

ch.rasc:wampspring (>=1.0.1, <=1.1.0), ch.rasc:wampspring-session (1.1.0) +13 more potentially affected by CVE-2026-41838 via org.springframework:spring-websocket (4.1.4.release)

org.springframework:spring-websocket MAVEN version 4.1.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-websocket and may be impacted: - ch.rasc:wampspring =1.0.1, =1.0.2, =1.0.0, =1.0.0, =1.0.0, =0.10, =0.10, =6.0.0...

CVE-2026-41838

IDs for WebSocket sessions in the spring-websocket module are not cryptographically unpredictable, which may be possible to exploit in combination with inadequate authorization rules. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 throug...

CVE-2026-41838

IDs for WebSocket sessions in the spring-websocket module are not cryptographically unpredictable, which may be possible to exploit in combination with inadequate authorization rules. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 throug...

Linux Distros Unpatched Vulnerability : CVE-2026-41838

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - IDs for WebSocket sessions in the spring-websocket module are not cryptographically unpredictable, which may be possible to exploit in combination with inadequa...

CVE-2026-41838: Use of Insufficiently Random Values

IDs for WebSocket sessions in the spring-websocket module are not cryptographically unpredictable, which may be possible to exploit in combination with inadequate authorization rules. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 throug...

CVE-2026-41838: Spring Framework Predictable Session ID in WebSocket Module

IDs for WebSocket sessions in the spring-websocket module are not cryptographically unpredictable, which may be possible to exploit in combination with inadequate authorization rules...

ai.aitia:arrowhead-application-library-java-spring (>=4.4.0.2, <=4.6.0.0), br.com.m4rc310:br-com-m4rc310-graphql (1.0.1) +1237 more potentially affected by CVE-2026-41838 via org.springframework:spring-websocket (>=5.3.0, <=5.3.39)

org.springframework:spring-websocket MAVEN version =5.3.0, =4.4.0.2, =5.3.0, =5.6.5, =5.3.0, =5.3.0, =5.3.0, =5.3.0, =6.2.0, =6.8.0, =6.4.0, =5.3.0, =6.10.5 and more Source cves: CVE-2026-41838 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORK-17254123...

com.consol.citrus:citrus-websocket (2.7.3), com.estafet.microservices.scrum:microservices-scrum-parent-db (>=1.0.0, <=1.0.4) +236 more potentially affected by CVE-2025-41254 via org.springframework:spring-websocket (4.3.11.release)

org.springframework:spring-websocket MAVEN version 4.3.11.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-websocket and may be impacted: - com.consol.citrus:citrus-websocket 2.7.3 -...

org.springframework.boot:spring-boot-starter-websocket (1.2.8.release) potentially affected by CVE-2025-41254 via org.springframework:spring-websocket (4.1.9.release)

org.springframework:spring-websocket MAVEN version 4.1.9.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-websocket and may be impacted: - org.springframework.boot:spring-boot-starter-websocket 1.2.8.release Source cve...

ai.aitia:arrowhead-application-library-java-spring (>=4.4.0.0, <=4.6.0.0), br.com.m4rc310:br-com-m4rc310-graphql (1.0.1) +1872 more potentially affected by CVE-2025-41254 via org.springframework:spring-websocket (>=5.0.0.release, <=5.3.39)

org.springframework:spring-websocket MAVEN version =5.0.0.release, =4.4.0.0, =3.4.0, =5.6.5, =4.1.0, =4.1.0, =3.6.0, =3.1.0, =5.3.0, =6.2.0, =5.1.0, =6.8.0, =6.10.5 and more Source cves: CVE-2025-41254 Source advisory: OSV:GHSA-7FCH-4F2F-JCGM...

cn.ymotel:dactor (>=1.0.1, <=1.0.15), org.springframework.boot:spring-boot-starter-websocket (1.5.19.release) +1 more potentially affected by CVE-2025-41254 via org.springframework:spring-websocket (4.3.22.release)

org.springframework:spring-websocket MAVEN version 4.3.22.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-websocket and may be impacted: - cn.ymotel:dactor =1.0.1, =1.0.15 -...

com.ahome-it:ahome-tooling-server-core (>=1.1.19-release, <=1.1.26-release), com.ahome-it:ahome-tooling-server-hazelcast (>=1.1.23-release, <=1.1.25-release) +114 more potentially affected by CVE-2025-41254 via org.springframework:spring-websocket (4.3.4.release)

org.springframework:spring-websocket MAVEN version 4.3.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-websocket and may be impacted: - com.ahome-it:ahome-tooling-server-core =1.1.19-release, =1.1.23-release,...

org.springframework.boot:spring-boot-starter-websocket (>=1.1.9.release, <=1.1.10.release) potentially affected by CVE-2025-41254 via org.springframework:spring-websocket (4.0.8.release)

org.springframework:spring-websocket MAVEN version 4.0.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-websocket and may be impacted: - org.springframework.boot:spring-boot-starter-websocket =1.1.9.release,...

ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base (1.5), ca.uhn.hapi.fhir:hapi-fhir-testpage-overlay (1.5) +10 more potentially affected by CVE-2025-41254 via org.springframework:spring-websocket (4.2.5.release)

org.springframework:spring-websocket MAVEN version 4.2.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-websocket and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base 1.5 -...

org.lightadmin:light-logging-configurer (1.0.0.rc1) potentially affected by CVE-2025-41254 via org.springframework:spring-websocket (4.1.0.release)

org.springframework:spring-websocket MAVEN version 4.1.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-websocket and may be impacted: - org.lightadmin:light-logging-configurer 1.0.0.rc1 Source cves: CVE-2025-41254...

com.ahome-it:ahome-tooling-server-core (>=1.0.110-release, <=1.0.120-release), com.ahome-it:ahome-tooling-server-hazelcast (>=1.0.111-release, <=1.0.120-release) +10 more potentially affected by CVE-2025-41254 via org.springframework:spring-websocket (4.2.1.release)

org.springframework:spring-websocket MAVEN version 4.2.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-websocket and may be impacted: - com.ahome-it:ahome-tooling-server-core =1.0.110-release, =1.0.111-release,...

com.ahome-it:ahome-tooling-server-core (>=1.1.10-release, <=1.1.12-release), com.ahome-it:ahome-tooling-server-hazelcast (>=1.1.10-release, <=1.1.12-release) +110 more potentially affected by CVE-2025-41254 via org.springframework:spring-websocket (4.3.2.release)

org.springframework:spring-websocket MAVEN version 4.3.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-websocket and may be impacted: - com.ahome-it:ahome-tooling-server-core =1.1.10-release, =1.1.10-release,...

net.solarnetwork.common:net.solarnetwork.common.web (>=2.2.0, <=2.4.0), org.springframework.boot:spring-boot-starter-websocket (1.5.20.release) +1 more potentially affected by CVE-2025-41254 via org.springframework:spring-websocket (4.3.23.release)

org.springframework:spring-websocket MAVEN version 4.3.23.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-websocket and may be impacted: - net.solarnetwork.common:net.solarnetwork.common.web =2.2.0, =2.4.0 -...

com.caucho:spring4-websocket (>=4.0.62, <=4.0.63), net.apexes.wsonrpc:wsonrpc-server-support (>=2.2.0, <=2.8.0) +3 more potentially affected by CVE-2025-41254 via org.springframework:spring-websocket (4.3.25.release)

org.springframework:spring-websocket MAVEN version 4.3.25.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-websocket and may be impacted: - com.caucho:spring4-websocket =4.0.62, =2.2.0, =2.8.0 -...